Dashboard-vs-STATE CI gate + Phase B (CNO-law proptest, delete legacy tree, honest obliteration) (#81)

Two threads of estate-honesty work in januskey. All changes build clean
and are test-verified.

## Thread 1 — `dashboard-check`: make "dashboards that lie" a build
failure

New Rust workspace crate `crates/dashboard-check` (Rust =
policy-preferred CLI language) that reads the machine-readable **source
of truth** (`.machine_readable/6a2/STATE.a2ml`) and fails CI when a
hand-maintained dashboard diverges from it — the structural fix for the
estate's #1 recurring defect (the historical `TOPOLOGY.md` "100%
Production Ready" vs `STATE.a2ml` 60%/Grade-D).

- `a2ml` is TOML, so it parses with the `toml` crate (no bespoke
reader). Extracts `completion-percentage` / `crg-grade` / `last-updated`
(tolerating januskey's quoted `"60"`/`"D"` and other repos' bare
integers); asserts they match `TOPOLOGY.md` (`OVERALL: …%`, `Grade X`)
and `READINESS.md` (`CRG Grade: X`), and that the dashboard isn't older
than STATE.
- **8 unit tests** (quoted+bare parsing, every drift class,
aligned-pass, and a prose-shadowing regression).
- **Verified end-to-end:** passes on this repo; catches an injected
100%-vs-60% drift with the exact `completion mismatch` message.
- Wired as `just check-dashboard` + CI job **Dashboard Check** (SPDX
header, `contents: read`, SHA-pinned actions). Prototyped here; designed
to be vendored estate-wide.

## Thread 3 — Phase B honesty/tests

- **B5 — runnable reversibility evidence.** A property test asserting
the CNO round-trip law `execute∘undo ≡ identity` on the filesystem,
across all supported operations over random content (temp tree + stores,
snapshot → execute → undo with a fresh executor → assert byte-for-byte
restored). The honest substitute for the "formal proofs pending" badge.
Chown excluded (undo unimplemented); tests the filesystem effect, not
the deliberately non-involutive `OperationType::inverse`.
- **B2 — delete the legacy `src/januskey/` monolith** (non-workspace,
pre-extraction duplicate of `crates/januskey-cli`, labelled LEGACY).
Every reference repointed (README, ARCHITECTURE, EXPLAINME, docs/wiki,
`idrisiser/*.tsig`); the two contractile checks that scanned it
simplified (they already preferred `crates/januskey-cli`).
`src/abi/*.idr` (Idris ABI) untouched. No dangling references remain.
- **B8 — stop overstating obliteration.** The doc-comment claimed
content is "cryptographically unrecoverable"; overwrite-in-place can't
guarantee physical erasure on SSD/CoW/journaling media (the caveat
already lived in `threat-model.a2ml`). Mirrored that honest wording into
`obliteration.rs` and softened the README claim, with the obliteration
exception called out.

## Verification
- `cargo build --workspace` — clean.
- `cargo test -p januskey --lib` — **26 passed**; `--test
property_tests` — **4 passed** (incl. the new CNO-law case); `cargo test
-p dashboard-check` — **8 passed**.
- `dashboard-check --check .` — green on this repo; clippy clean on the
new crate.

## Context
Threads 1 & 3 of a three-thread follow-up (Lean mirror merged in #110;
this is the januskey pair). Draft pending human review.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_015qwVESTcbfanY2iJPQNoSz

---
_Generated by [Claude
Code](https://claude.ai/code/session_015qwVESTcbfanY2iJPQNoSz)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/dashboard-check.yml

@@ -0,0 +1,30 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# dashboard-check.yml — fail the build when a hand-maintained status dashboard
+# (TOPOLOGY.md / READINESS.md) diverges from the machine-readable STATE.a2ml.
+# Structural defence against the "dashboards that lie" failure mode.
+name: Dashboard Check
+
+on:
+  pull_request:
+    branches: ['**']
+  push:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+jobs:
+  dashboard-check:
+    name: STATE vs dashboard reconciliation
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+
+      - name: Reconcile dashboards against STATE.a2ml
+        run: cargo run -q -p dashboard-check -- --check .

.machine_readable/contractiles/Adjustfile.a2ml

@@ -77,7 +77,7 @@ Standard: WCAG-2.2-AA (CLI/TUI profile).
 
 ### panic-pattern-drift
 - description: No regression of the 2026-04 unwrap()/expect("TODO") sweeps in security-critical modules
-- tolerance: 0 new bare unwrap() in crates/*/src and src/januskey/src
+- tolerance: 0 new bare unwrap() in crates/*/src
 - corrective: Run `just assail` (panic-attacker pre-commit scan)
 - severity: advisory
 

.machine_readable/contractiles/Trustfile.a2ml

@@ -117,8 +117,6 @@ unjustified, it has no place here. Trust never overrides MUST.
     # OR the file does not exist. Fails while the home-rolled pattern is present.
     if [ -f crates/januskey-cli/src/attestation.rs ]; then \
       ! grep -qE 'Sha256::new\(\).*update.*key.*update.*data' crates/januskey-cli/src/attestation.rs; \
-    elif [ -f src/januskey/src/attestation.rs ]; then \
-      ! grep -qE 'Sha256::new\(\).*update.*key.*update.*data' src/januskey/src/attestation.rs; \
     else true; fi
 - severity: critical
 
@@ -129,7 +127,7 @@ unjustified, it has no place here. Trust never overrides MUST.
     # Passes if ed25519-dalek or x25519-dalek is a real dependency, OR if
     # Ed25519 / X25519 are not listed in any KeyAlgorithm enum.
     cargo tree 2>/dev/null | grep -qE '(ed25519-dalek|x25519-dalek)' || \
-      ! grep -rqE '(Ed25519|X25519)' crates/januskey-cli/src/ src/januskey/src/ 2>/dev/null
+      ! grep -rqE '(Ed25519|X25519)' crates/januskey-cli/src/ 2>/dev/null
 
 ## Secrets-hygiene (memory rule: SOPS at-rest / Rokur runtime / RGTV LLM-broker)
 

ARCHITECTURE.md

@@ -42,8 +42,6 @@ januskey/
 │       ├── delta           — Differential operations
 │       ├── main            — jk CLI binary
 │       └── keys_cli        — jk-keys CLI binary
-│
-└── src/januskey/           ← LEGACY (pre-extraction, superseded by crates/)
 ```
 
 ## reversible-core: The Shared Foundation

Cargo.lock

@@ -2,7 +2,7 @@
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
 
 [workspace]
-members = ["crates/reversible-core", "crates/januskey-cli"]
+members = ["crates/reversible-core", "crates/januskey-cli", "crates/dashboard-check"]
 resolver = "2"
 
 [workspace.package]

Cargo.toml

@@ -10,19 +10,19 @@ The README makes claims. This file backs them up.
 
 === Claim 1: "100% Reversible - Every operation can be undone, always"
 
-**How it works:** JanusKey implements architectural reversibility by storing inverted operations alongside each mutation. The delete operation, implemented in `src/januskey/src/obliteration.rs`, calculates and stores a full restoration record before removing file content. The `delta.rs` module generates inverse metadata that sufficient to reconstruct the pre-operation state. Every operation in the transaction layer (`src/januskey/src/metadata.rs`) maintains a "prior state" record, enabling perfect reversal through the `undo` pathway.
+**How it works:** JanusKey implements architectural reversibility by storing inverted operations alongside each mutation. The delete operation, implemented in `crates/januskey-cli/src/obliteration.rs`, calculates and stores a full restoration record before removing file content. The `delta.rs` module generates inverse metadata that sufficient to reconstruct the pre-operation state. Every operation in the transaction layer (`crates/januskey-cli/src/metadata.rs`) maintains a "prior state" record, enabling perfect reversal through the `undo` pathway.
 
 **Caveat:** Reversibility is strong only when the operation log remains intact. If `.jk/` metadata store is corrupted or lost, recovery becomes impossible. The system trades **write amplification** (each operation doubles metadata I/O) for guaranteed recoverability.
 
-**Evidence:** `src/januskey/src/lib.rs` (public API) delegates to `obliteration.rs` and `delta.rs` for operation logic; see `Reversible` trait (if present) or reversibility-proof comments in `attestation.rs`.
+**Evidence:** `crates/januskey-cli/src/lib.rs` (public API) delegates to `obliteration.rs` and `delta.rs` for operation logic; see `Reversible` trait (if present) or reversibility-proof comments in `attestation.rs`.
 
 === Claim 2: "Complete Audit Trail - Every change tracked automatically"
 
-**How it works:** The metadata store (`src/januskey/src/metadata.rs`) maintains an append-only operation log. The `attestation.rs` module calculates cryptographic commitments (SHA256 hashes) of each operation, creating a tamper-evident chain. Content-addressed storage (`src/januskey/src/content_store.rs`) ensures deduplication by content hash, preventing duplicate storage while maintaining full history.
+**How it works:** The metadata store (`crates/januskey-cli/src/metadata.rs`) maintains an append-only operation log. The `attestation.rs` module calculates cryptographic commitments (SHA256 hashes) of each operation, creating a tamper-evident chain. Content-addressed storage (`crates/januskey-cli/src/content_store.rs`) ensures deduplication by content hash, preventing duplicate storage while maintaining full history.
 
 **Caveat:** The audit trail is only as trustworthy as the append-only mechanism. If the log is truncated or rewritten on-disk, the chain breaks. For forensic-grade auditing, integrate with an external append-only store (database, blockchain).
 
-**Evidence:** `src/januskey/src/metadata.rs` defines the log structure; `attestation.rs` computes cryptographic bindings; `content_store.rs` handles SHA256 hashing.
+**Evidence:** `crates/januskey-cli/src/metadata.rs` defines the log structure; `attestation.rs` computes cryptographic bindings; `content_store.rs` handles SHA256 hashing.
 
 == Technology Choices
 
@@ -41,15 +41,15 @@ The README makes claims. This file backs them up.
 |===
 | Path | Purpose
 
-| `src/januskey/src/main.rs` | CLI entry point, command dispatch (delete, modify, move, copy, undo, begin, commit, rollback, preview)
-| `src/januskey/src/lib.rs` | Public API: init, delete, modify, move, copy, undo, transaction logic
-| `src/januskey/src/obliteration.rs` | Delete operation with restoration metadata
-| `src/januskey/src/delta.rs` | Computes inverse operations (modify undo, move undo, copy undo)
-| `src/januskey/src/metadata.rs` | Append-only operation log, transaction tracking, rollback state
-| `src/januskey/src/content_store.rs` | SHA256 content hashing, deduplication, storage management
-| `src/januskey/src/attestation.rs` | Cryptographic commitments, audit trail, tamper detection
-| `src/januskey/src/keys.rs` | Cryptographic key management (if key-based reversibility)
-| `src/januskey/src/error.rs` | Error types and propagation
+| `crates/januskey-cli/src/main.rs` | CLI entry point, command dispatch (delete, modify, move, copy, undo, begin, commit, rollback, preview)
+| `crates/januskey-cli/src/lib.rs` | Public API: init, delete, modify, move, copy, undo, transaction logic
+| `crates/januskey-cli/src/obliteration.rs` | Delete operation with restoration metadata
+| `crates/januskey-cli/src/delta.rs` | Computes inverse operations (modify undo, move undo, copy undo)
+| `crates/januskey-cli/src/metadata.rs` | Append-only operation log, transaction tracking, rollback state
+| `crates/januskey-cli/src/content_store.rs` | SHA256 content hashing, deduplication, storage management
+| `crates/januskey-cli/src/attestation.rs` | Cryptographic commitments, audit trail, tamper detection
+| `crates/januskey-cli/src/keys.rs` | Cryptographic key management (if key-based reversibility)
+| `crates/januskey-cli/src/error.rs` | Error types and propagation
 |===
 
 == Dogfooted Across The Account

EXPLAINME.adoc

@@ -31,6 +31,10 @@ fmt:
 lint:
     cargo clippy --workspace -- -D warnings
 
+# Fail if a hand-maintained dashboard diverges from STATE.a2ml (source of truth)
+check-dashboard:
+    cargo run -q -p dashboard-check -- --check .
+
 # Run benchmarks
 bench:
     cargo bench --workspace

Justfile

@@ -38,8 +38,11 @@ pending).
 
 - **Instant Rollback** - Undo changes in milliseconds
 
-- **Data loss impossible by construction** - the architectural goal the
-  pending proofs are to establish
+- **Data loss resistant by construction** - reversibility is the
+  architectural goal the pending proofs are to establish. (Note: *secure
+  obliteration* is the deliberate exception and is best-effort only —
+  overwrite-in-place cannot guarantee physical erasure on SSD/CoW/journaling
+  media; see the threat model.)
 
 - **Complete Audit Trail** - Every change tracked automatically
 
@@ -51,8 +54,7 @@ pending).
 
 ```bash
 # Build from source (requires Rust)
-cd src/januskey
-cargo build --release
+cargo build --workspace --release
 
 # Initialize JanusKey in your project
 jk init
@@ -125,10 +127,10 @@ Every operation stores sufficient metadata for perfect inversion:
 ```bash
 # Clone the repository
 git clone {url-github}
-cd januskey/src/januskey
+cd januskey
 
 # Build release binary
-cargo build --release
+cargo build --workspace --release
 
 # Install to PATH
 cargo install --path .

README.md

@@ -57,6 +57,9 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 > CRG grade **D**) and `READINESS.md` (Grade **D — Alpha, Unstable**). This
 > dashboard is a human-readable summary of those files; if they disagree,
 > they win. Percentages below are qualitative, not measured coverage.
+> This agreement is now **machine-enforced**: `just check-dashboard`
+> (crate `crates/dashboard-check`, CI job `Dashboard Check`) fails the build
+> if the `OVERALL` percentage or grade here drifts from STATE.a2ml.
 
 ```
 COMPONENT                          STATUS              NOTES